5eb23cf07de7dffbd3c9c111ccab7da40e646feb
5133
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Noah Talerman
|
5eb23cf07d |
Fix enroll page and Add hosts modal styling issues (#48968)
For the following bug: - #48967 - [x] QA'd all new/changed functionality manually |
||
|
Noah Talerman
|
6259f14287 |
Support all Apple declaration (DDM) profiles and assets: Copy change (#49308)
For the following story: - https://github.com/fleetdm/fleet/issues/38986 |
||
|
Allen Houchins
|
1a81e3551f |
Add Mozilla VPN as a macOS and Windows FMA (#49284)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49149 Adds **Mozilla VPN** as a Fleet-maintained app for both macOS (Homebrew cask `mozilla-vpn`) and Windows (winget `Mozilla.VPN`), version 2.38.0. Identity fields verified against the real installers (not catalog metadata): | | macOS | Windows | |---|---|---| | `unique_identifier` | `org.mozilla.macos.FirefoxVPN` (CFBundleIdentifier from pkg PackageInfo) | `Mozilla VPN` (MSI `ProductName`) | | Publisher | — | `Mozilla Corporation` (MSI `Manufacturer` = winget locale, no override needed) | | Format/type | `pkg` | `msi` (winget `wix`, machine scope, `ALLUSERS=1`) | - Install/uninstall scripts auto-generated (machine-scope MSI + cask artifacts/zap) — no custom scripts. - Generated SHAs match the manifests (macOS `2803d4b4…`, Windows `11a270b3…`). - No bootstrapper (`ARPSYSTEMCOMPONENT` absent); pinned installer URLs; no risk flags. - On Windows, osquery reports `programs.version` as `2.38.0.0` vs the FMA's `2.38.0`; `version_compare` treats a fresh install as ≥ target, so the patch policy reports patched correctly. - New app icon generated (`MozillaVpn.tsx`, website PNG, `index.ts` map key `"mozilla vpn"` shared by both platforms). # Checklist for submitter - [ ] QA'd all new/changed functionality manually |
||
|
Noah Talerman
|
0e917c2231 |
Fix inconsistent modal scroll behavior (#48789)
- [x] QA'd all new/changed functionality manually For the following quick win: - #48788 |
||
|
github-actions[bot]andRachelElysia
|
35ee986268 |
Fleet UI: Update osquery version options (#48247)
Automated update of MIN_OSQUERY_VERSION_OPTIONS with any new osquery release. (Note: This automatic update is the solution to issue #21431) Co-authored-by: RachelElysia <RachelElysia@users.noreply.github.com> |
||
|
LeAnn
|
1be50fd760 |
Ensure that the options and copy for both Add hosts - Android and iOS/iPadOS are the same (#49227)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42721 ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Updated iOS/iPadOS enrollment labeling to clarify the fully managed company-owned option. * Added enrollment guidance explaining that users must download the profile in their browser and install it to enroll in Fleet. * **Tests** * Expanded coverage to verify the updated enrollment option and instructions on iOS/iPadOS and Android. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
RachelElysia
|
cee838b25f | Fleet UI: Remove blue click flash on clickable table rows (#49228) | ||
|
Juan Fernandez
|
82db4d5389 |
macOS & iOS/iPadOS: Rename hosts
Resolves #38806 Add an IT-admin naming convention for macOS/iOS/iPadOS hosts. An admin sets a name template (e.g. "iPad $FLEET_VAR_HOST_HARDWARE_SERIAL") under Controls > OS settings > Host names for a fleet or for "No team"; Fleet resolves it per host, delivers it via an Apple `Settings`/`DeviceName` MDM command, renames its own record on ACK, then verifies the name via osquery (macOS) or a DeviceInformation refetch (iOS/iPadOS). Clearing the template stops enforcement without renaming any host. Fleet Premium only, mirroring disk encryption. |
||
|
RachelElysia
|
ca1acc2467 | Fleet UI: Show tooltip for truncated vulnerabilities list in Update details modal (#49236) | ||
|
Allen Houchins
|
7ba5d4cfcc |
Add Windows FMAs (letter F): 5 apps (#49218)
**Related issue:** N/A — part of the Windows Fleet-maintained apps catalog expansion (letter F batch; follows #48872, #48881, #48950, #48969, #49086, #49186). Adds eight new Windows Fleet-maintained apps: | App | winget package | Installer | Notes | |-----|----------------|-----------|-------| | Foxit PDF Editor | `Foxit.PhantomPDF` | WiX bootstrapper EXE, machine, x64 | Covers both "Foxit PDF Editor" and "…Pro" from the inventory (one package). Runs an updater service → process-stopping uninstall. ARP key lives in the WOW6432Node hive. | | Foxit PDF Reader | `Foxit.FoxitReader` | WiX bootstrapper EXE, machine, x64 | Distinct DisplayName from the Editor (verified via msiinfo). Updater service → process-stopping uninstall. | | FreeCAD | `FreeCAD.FreeCAD` | NSIS (MultiUser), machine, x64 | `/AllUsers /S`; versioned ARP name ("FreeCAD 1.1.1") → `FreeCAD%` fuzzy. | | FastPictureViewer Professional | `AxelRietschin.FastPictureViewer.Professional` | MSI, machine, x64 | Versioned ARP name → fuzzy. Unversioned URL → `ignore_hash`. Declares VCRedist deps (near-ubiquitous; noted). | | FastStone Capture | `FastStone.Capture` | NSIS, machine, x86 | `/S`; versioned ARP name → fuzzy. Paid trialware, but silent install/detect/uninstall are clean. | | FastStone Image Viewer | `FastStone.Viewer` | NSIS, machine, x86 | `/S`; versioned ARP name → fuzzy. | | FlexWhere for Desktop | `Dutchview.Flexwhere` | MSI, machine, x64 | Auto-start tray app → process-stopping uninstall (stop process, then msiexec /x via UpgradeCode). | | Fortify | `PeculiarVentures.Fortify` | WiX MSI, machine, x64 (en-US) | Smart-card/cert bridge; auto-start tray → process-stopping uninstall. Per-arch+locale ProductCode, so `installer_locale: en-US`. | Considered but **not** added (recorded in the workstream tracker): - **FactSet Workstation** (`FactSet.FactSetWorkstation`): MSI defaults to per-user (ALLUSERS=2 + MSIINSTALLPERUSER=1) with no machine-scope override, AND a `SpawnFDSWorkstation` custom action launches the app at install (headless-hang risk in a SYSTEM session). Niche licensed terminal. - **Filius** (`StefanFreischlad.Filius`): winget manifest is de-DE only (no en-US locale); the ingester hard-codes the en-US locale fetch (same limitation that deferred Araxis Merge). - **FlashFXP** (`OpenSight.FlashFXP`): abandoned (frozen at 2017), the vendor site returns HTTP 500, only a 16×16 icon is available, and its InstallAware uninstall needs a fragile cached-setup `/s` injection. - **Front** (`FrontApp.Front`): per-user-only electron-builder installer (`Front-user-*.exe` → `%LocalAppData%`, HKCU); no machine/all-users artifact in winget. - **Autodesk Fusion** (`Autodesk.Fusion`): the winget "installer" is `Fusion Client Downloader.exe`, a per-user streaming/web bootstrapper that downloads at runtime, hangs headless, and needs interactive Autodesk sign-in. Identities verified per app (msiinfo Property tables; NSIS header decompilation; winget AppsAndFeaturesEntries; uninstall-database corroboration). Apps that run a service or auto-start tray (both Foxit products, FlexWhere, Fortify) get process-stopping uninstalls up front to avoid the MSI-rollback failure class. SHAs verified against manifests for pinned URLs; `ignore_hash` only for FastPictureViewer's actively-maintained latest-pointer URL. Icons via `tools/software/icons/generate-icons.sh` (all ≥256px except FastPictureViewer/Fortify at 256/180). # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [ ] QA'd all new/changed functionality manually (relying on the FMA CI validator for Windows install/uninstall validation) |
||
|
Sharon Katz
|
4374d4d03f |
Ensure unit test coverage for all external library upgrades (#48949)
**Related issue:** Closes #48943 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Summary Adds unit test coverage for external library upgrades that had no automated tests: - **DOMPurify** (`ClickableUrls_xss.tests.tsx`): 5 XSS sanitization tests (script injection, javascript: in href, event handlers, iframe, URL preservation) - **react-markdown + remark-gfm** (`FleetMarkdown.tests.tsx`): 9 rendering tests (plain text, bold/italic, links, lists, GFM tables, strikethrough, code blocks, inline code) - **sonner** (`ToastNotification.tests.tsx`): 9 notify API tests (success/error creation, empty-message fallback, custom id, dismiss, batch, HTTP status label, axios response unwrap) These gaps were identified through a comprehensive audit of all ~353 direct dependencies across Go and frontend. The Go backend has excellent coverage (669+ test files). The frontend now has 333+ test files covering all runtime libraries except 2 that are untestable at unit level (systray GUI, sockjs WebSocket). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added coverage confirming potentially unsafe HTML and links are sanitized before rendering, including protection against script, `javascript:` URLs, and injected content. * Added tests validating Markdown rendering for plain text, links, fenced code blocks, and inline code. * Added coverage for toast notifications, including success/error flows, batching, dismissal, fallback messaging, ID handling, and mapping response details. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
bfb0f297db |
Fix Policies automations filter disappearing for the Unassigned fleet (#49224)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44624 Switching to the "Unassigned" fleet with an automation filter already set kept the filter's value in the URL, but the filter dropdown's option list silently collapsed to only "All automations" and "Webhooks or tickets" — the same restricted set used for "All fleets" — because the "Unassigned" fleet's team ID (0) is falsy and was treated the same as the undefined team ID used for "All fleets". This made the filter appear to disappear from the UI. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually #### Before (issue's video) https://github.com/user-attachments/assets/a2bca626-5700-4174-beb2-94aadf847a6c #### After https://github.com/user-attachments/assets/a5912056-02ef-4827-8110-29ad4d629fa8 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed the automations filter on the Policies page so it remains visible when viewing the Unassigned fleet. * Preserved the selected automation filter when switching views. * Updated available options for Unassigned fleets by excluding Calendar while retaining supported automation types. * Improved the empty-state experience when no policies match the selected filters. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rahul Raghunathan
|
9f8caea025 |
Fix tables losing row selection on window focus (#48742)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48542 ## Description The `QueryClient` was created with `new QueryClient()` and no default options, so every query inherited React Query's default `refetchOnWindowFocus: true`. On pages like `/policies` and `/users`, queries are refetched every time the browser window regains focus. Those focus refetches re-rendered the table with fresh data, tripping react-table's `autoResetSelectedRows` and `autoResetPage` (both default `true`), so the table appeared to "reload," clearing the user's row selection and jumping back to the first page when they clicked away and back. ## Screen recording demonstrating the fix https://github.com/user-attachments/assets/eabf30a5-65d3-420d-a8d3-5a529fa06089 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevented users and policies tables from unexpectedly reloading when switching back to the browser window. * Preserved table state such as selected rows and current pagination instead of resetting to the first page. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Marko Lisica
|
fb3932f37a |
Update CustomLink styles (#48838)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #35328 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved link hover and `:focus-visible` underline/outline behavior for more consistent accessibility across tables, buttons, and modals. * Fixed script name hover underline clipping in the run script modal. * **Style** * Refreshed `CustomLink` styling with an emphasized variant and improved underline behavior, plus updated related link/table/button styling for a unified look. * Updated “Connect Fleet” info-banner messaging and CTAs for calendar and conditional access automations; refreshed “No scripts available” empty state. * **Tests** * Updated modal tests to match revised link text and accessible names. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
7ac8c659e0 |
Add Windows FMAs (letter E): 13 apps (#49186)
**Related issue:** N/A — part of the Windows Fleet-maintained apps catalog expansion (letter E batch; follows #48872, #48881, #48950, #48969, #49086). Adds eleven new Windows Fleet-maintained apps: | App | winget package | Installer | Notes | |-----|----------------|-----------|-------| | Eclipse Temurin JDK 8 | `EclipseAdoptium.Temurin.8.JDK` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JDK 11 | `EclipseAdoptium.Temurin.11.JDK` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JDK 17 | `EclipseAdoptium.Temurin.17.JDK` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JDK 21 | `EclipseAdoptium.Temurin.21.JDK` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JRE 8 | `EclipseAdoptium.Temurin.8.JRE` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JRE 11 | `EclipseAdoptium.Temurin.11.JRE` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JRE 17 | `EclipseAdoptium.Temurin.17.JRE` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JRE 21 | `EclipseAdoptium.Temurin.21.JRE` | MSI (WiX), machine, x64 | Per-major pin. | | exacqVision Client | `ExacqTechnologies.exacqVisionClient` | MSI, machine, x64 | Clean MSI; ARP name `exacqVision Client (x64)`. | | Egnyte WebEdit | `Egnyte.EgnyteWebEdit` | MSI, machine, x86 | Distinct product from the existing Egnyte Desktop FMA (separate ProductCode/UpgradeCode/ARP name). | | Elevate UC | `Serverdata.ElevateUC` | MSI, machine, x64 | Intermedia UC client. Unversioned latest-pointer URL with ~monthly cadence → `ignore_hash`. | **Eclipse Temurin (8 apps).** All are clean machine-scope WiX MSIs from Eclipse Adoptium. The ARP DisplayName embeds the full patch version — `Eclipse Temurin JDK with Hotspot 17.0.19+10 (x64)` — and JDK/JRE of the same major share a version prefix, so each major is pinned with an `exists_query` that combines the JDK-vs-JRE name prefix, the publisher, and a major version filter, e.g.: ``` SELECT 1 FROM programs WHERE name LIKE 'Eclipse Temurin JDK%' AND publisher = 'Eclipse Adoptium' AND version LIKE '17.%'; ``` The `JDK`/`JRE` token in the name prefix keeps a JDK install from matching the JRE FMA and vice-versa; the `version LIKE '<major>.%'` keeps each major distinct. This mirrors the existing Amazon Corretto per-major FMAs. Identities (DisplayName, publisher `Eclipse Adoptium`, 4-part ProductVersion) were verified via `msiinfo` on the real x64 MSIs. Considered but **not** added (recorded in the workstream tracker): - **ESET Endpoint Antivirus** (`ESET.EndpointAntivirus`) and **ESET Endpoint Security** (`ESET.EndpointSecurity`): the install succeeds headless without a license, but uninstall is Self-Defense (HIPS) protected — it requires a reboot to complete and is widely documented to fail unattended (needing the ESET Uninstaller Tool in Safe Mode), so a reliable silent SYSTEM-context removal can't be guaranteed. They're also managed enterprise agents meant for central ESET PROTECT deployment (standalone installs land unactivated and disable Windows Defender). Still to verify (not in this PR): EndNote, Enpass, Evernote, and UltraISO — their verification pass was interrupted and will be handled separately. Identities verified via `msiinfo` Property tables. SHAs verified against manifests for pinned URLs; `ignore_hash` used only for Elevate UC's actively-maintained latest-pointer URL. Icons via `tools/software/icons/generate-icons.sh`. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [ ] QA'd all new/changed functionality manually (relying on the FMA CI validator for Windows install/uninstall validation) |
||
|
Josh Roskos
|
9539535321 |
Supress install all for all/undefined software category (#48999)
**Related issue:** Resolves #49013 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Hid the **Install all** button on the unfiltered **All** software view. * Kept **Install all** available when a specific category is selected. * Updated install-all behavior so the correct category is used when launching installs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
29bef37837 |
Add macOS app filter to My device software (#48637)
Expose the existing "Applications" / "Full inventory" software filter on the Fleet Desktop My device Software tab for macOS hosts. The filter now defaults to Applications for macOS, sends `macos_applications` to the device software API, and keeps that query param during pagination. Updated table tests cover rendering and URL behavior on My device and non-macOS hosts. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48636 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added the **Applications / Full inventory** software filter to the **My device > Software** tab for macOS devices. * The selected filter is now preserved when navigating through software results. * **Bug Fixes** * Corrected software filtering behavior across device pages and platforms. * Prevented the macOS filter parameter from being added for non-macOS devices. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew MellorandJordan Montgomery
|
2eb1cba2dd |
46959 Add Account Provisioning settings to UI for FPSSO configuration (#47655)
**Related issue:** Resolves #46959 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple account provisioning configuration UI in integrations settings with token URL, client ID, and client secret fields. * Added activity tracking for Apple account provisioning changes. * **Documentation** * Renamed integration settings labels for clarity: "Ticketing", "Calendar events", "Certificate enrollment", "User mapping", "Authentication (SSO)", and "Host status alerts". <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> |
||
|
|
078fbc0f40 |
Add Targeted platforms column and platform filter to Policies page (#44125)
- @noahtalerman: For the following quick win: - https://github.com/fleetdm/fleet/issues/23737 ## Summary Adds a "Targeted platforms" column and a platform filter dropdown to the Policies page (`/policies/manage`), matching the pattern already used on the Reports page (`/queries/manage`, `ManageQueriesPage`). ### Frontend - New non-sortable **Targeted platforms** column rendered via `PlatformCell`, sourced from each policy's comma-separated `platform` field. - New platform filter dropdown (All / macOS / Windows / Linux / ChromeOS) wired as a `customControl` on the Policies table, alongside the existing automation filter. Selecting a value pushes a new URL (not a replace), resets `page` to 0, and updates the `platform` query param. - `ManagePoliciesPage` reads `location.query.platform` and threads it through to both `globalPoliciesAPI.loadAll` / `teamPoliciesAPI.loadAll` and the react-query keys, plus the count endpoints. The automation-filter and count "hide" conditions now include the platform filter so they remain visible when only a platform filter is active. - `frontend/services/entities/global_policies.ts` and `team_policies.ts` accept an optional `platform` param (with `"all"` normalized to `undefined`). - Added tests for the new column and dropdown in `PoliciesTable.tests.tsx`. ### Backend - Added `Platform string ` + `` `query:"platform,optional"` `` to `ListGlobalPoliciesRequest`, `CountGlobalPoliciesRequest`, `ListTeamPoliciesRequest`, `CountTeamPoliciesRequest`. - Extended datastore and service signatures (`ListGlobalPolicies`, `ListTeamPolicies`, `ListMergedTeamPolicies`, `CountPolicies`, `CountMergedTeamPolicies`, `ListGlobalPolicies`/`ListTeamPolicies` on the service) to accept a `platform string` arg. Mocks and all call sites updated. - Platform filtering in SQL uses a new helper `platformFilterClause`: ```sql AND (p.platforms = '' OR FIND_IN_SET(?, p.platforms)) ``` so policies targeting "all platforms" (empty `platforms` field) always match regardless of the selected filter. `FIND_IN_SET` uses a bound parameter (no injection risk). - Added a new MySQL integration test `testPoliciesPlatformFilter` covering empty-platform (match-all), per-platform filter, and team/merged paths. ### Docs - REST API docs for `GET /api/v1/fleet/global/policies`, `GET /api/v1/fleet/fleets/:id/policies`, and the corresponding `/count` endpoints now document the `platform` query param. - Added `changes/policies-targeted-platforms-filter`. ## Behavior - `platform=all` (or missing) returns all policies. - Selecting a specific platform returns policies whose `platforms` column is empty OR contains the selected token. - The dropdown only renders when the table is searchable (results exist OR any filter is active). - Changing the filter pushes a new URL and resets the page. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually Local verification: - `go build ./...` — clean - `go vet ./server/... ./cmd/... ./ee/...` — clean - `make lint-go-incremental` — 0 issues - Go service-level policy tests pass. MySQL integration tests compile but could not be run locally (no Docker); CI will exercise the new `testPoliciesPlatformFilter` test. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a "Targeted platforms" column with platform icons and an "All platforms" option. * Added a platform filter dropdown to scope policy lists; counts, last-updated, and controls adapt when a platform filter is active. Backend now honors an optional platform query parameter so filtering returns matching policies. * **Tests** * Added and updated unit and integration tests covering the new column, filter UI, and platform-filtered policy listings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: nulmete <nicoulmete1@gmail.com> |
||
|
Tim Lee
|
945a4d1518 | Filter Add certificate CA dropdown to custom SCEP only (#49020) | ||
|
Jonathan Katz
|
aa5813e4eb |
Fix invisible hover state in dark mode (#49001)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48531 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually Checked all the places according to this list: ``` Rule 1 — modal secondary buttons (Cancel / Done / Clear all) `body.dark-mode .modal__modal_container .button--inverse:hover, …` Affects any modal opened from *inside a card* (the only modals where the card-leak made hover invisible). There are **4 such surfaces**, all reachable from the Dashboard or Self-service: 1. **Dashboard → the chart card (Hosts online / vulnerability exposure) → Settings cog → the Settings modal** — hover **Cancel** and **Clear all**. *(issue #48531)* 2. **Dashboard → Activity card → click any activity's details link** — the details modal's footer button (Done/Cancel). This is 12 different activity-detail modals (script details, software install/uninstall details, VPP install, MDM command, etc.). 3. **Dashboard on a fresh instance (fewer than 2 hosts) → "Welcome to Fleet" card → click a policy row** — the policy modal. 4. **Fleet Desktop "My device" → Self-service tab → "Install all" button** — the Install-all-in-category modal's Cancel. ## Rule 2 — button `DropdownWrapper` hover `body.dark-mode .card .dropdown-wrapper__button .react-select__control:hover` Exactly **1 place** in the whole app: 5. **Software → click a software title → title details page → the "Actions ▾" dropdown** at the top-right of the summary card. *(Admin/maintainer only — it's gated behind "can manage software".)* ## Rule 3 — `ActionsDropdown` hover `body.dark-mode .card .actions-dropdown-select__control:hover` Exactly **2 places**: 6. **Host details → Reports tab → each report card header → "Actions ▾"**. *(The confirmed repro.)* 7. **Fleet Desktop "My device" → Self-service tab → a software row → "More ▾"** dropdown. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed dark-mode hover styling for buttons and dropdowns inside card components. * Restored the correct hover appearance for inverse buttons in modal containers. * Updated hover behavior for select-style dropdown controls so they match the card surface in dark mode. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
9185174faa |
Re-add Crestron AirMedia (+Peripherals) Windows FMAs (#49127)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A ## What changed Re-adds two Windows Fleet-maintained apps that were dropped from the letter C batch (#48969) **solely** because `www.crestron.com` returns HTTP 403 to Fleet's default Go `User-Agent`: - **Crestron AirMedia** (`Crestron.AirMedia`) - **Crestron AirMedia Peripherals** (`Crestron.AirMediaPeripherals`) Each gets an input JSON, a generated output, an `apps.json` catalog entry with description, a frontend icon component (+ `index.ts` registration), and a website icon PNG. Both are machine-scope MSIs (WiX) with upgrade-code uninstall; restored from their pre-drop state with outputs regenerated against the current winget manifests (versions unchanged: `5.11.1.164` / `1.11.1.164`, SHAs match). ## ⚠️ Depends on #49123 The 403 is fixed by #49123 (browser `User-Agent` in `DownloadInstaller`). Until #49123 merges and this branch is rebased on it, the FMA validator (`cmd/maintained-apps/validate`) will 403 downloading these installers. Merge #49123 first, then rebase/re-run CI here. ## Validation Run on a Windows validator with the #49123 UA fix in place — **both apps passed**: downloaded (confirming the UA fix unblocks `www.crestron.com`), installed, found via the exists query, and uninstalled cleanly. The `no changes in C:\Program Files` line is benign (they install elsewhere; the exists query still finds them). ## Dell Display and Peripheral Manager — investigated, dropped (not viable as an FMA) DDPM was verified and included in early revisions of this PR, then dropped. Its InstallShield (InstallScript) setup aborts with `0x80042000` in the validator's session-0 SYSTEM context across **every** documented silent switch — `/Silent`, `/S`, and `/Silent /HeadlessMode=true` all failed. Per silentinstallhq, DDPM 2.0+ requires the Windows Desktop Runtime (.NET) prerequisite installed first (extracted from the installer's own prerequisites folder), and its bundled InstallShield prerequisite chaining doesn't cooperate with a headless SYSTEM install; Dell's own community thread for this exact scenario (task sequence = SYSTEM) is unresolved. An FMA install script can't reliably extract-and-chain a runtime that may require a reboot, and DDPM only benefits hosts with Dell displays — so it's not a viable FMA. The identity work (verified DisplayName/publisher from the real installer) is recorded in the commit history if it's ever revisited. # Checklist for submitter - [ ] Changes file — N/A (FMA catalog data, consistent with prior letter batches which add no `changes/` entry). ## Testing - [x] Ran the ingester for both slugs; outputs + `apps.json` regenerated and validated as JSON. - [x] QA'd via the Windows FMA validator — both Crestron apps passed (with the #49123 UA fix present). |
||
|
Jordan MontgomeryandCopilot Autofix powered by AI
|
087ce7ab56 |
Add UI for assets (#49071)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48571 # Checklist for submitter If some of the following don't apply, delete the relevant line. No changes file as this is a subtask - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a Premium-only **Assets** tab to Configuration Profiles, with JSON asset list, upload, download, copy, and delete (delete limited for technician views). * Added a Premium-only **Assets** entry to the command palette configuration controls. * Introduced a new **file-json** graphic type and enhanced user-scoped profile indicators (with iOS/iPad-specific behavior). * **Bug Fixes** * Updated navigation so the **Assets** view opens consistently from settings and the command palette. * Improved visual alignment of tooltip/icon elements in asset and scope displays. * **Tests** * Added coverage for Assets, upload/download/delete behaviors, and related UI components. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Allen Houchins
|
b18b0c2a05 |
Add Windows FMAs (letter D): 12 apps (#49086)
**Related issue:** N/A — part of the Windows Fleet-maintained apps catalog expansion (letter D batch; follows #48872, #48881, #48950, #48969). Adds twelve new Windows Fleet-maintained apps: | App | winget package | Installer | Notes | |-----|----------------|-----------|-------| | DataSpell | `JetBrains.DataSpell` | NSIS (install4j), machine, x64 | Mirrors the DataGrip FMA pattern: `fuzzy_match_name` + `use_display_version_for_patch` (registry version is a JetBrains build number; marketing version parsed from the name). | | dnGrep | `dnGrep.dnGrep` | MSI, machine, x64 | Versioned+arch ARP name ("dnGrep 5.0.9 (x64)") → fuzzy match. | | Draftable Desktop | `Draftable.Draftable` | MSI, machine, x64 | Uses the machine-scope `DraftableDesktopSystem` MSI. **Caveat:** hard winget dependency on .NET 10 Desktop Runtime — installs fine but won't launch without it (same class as the BleachBit VCRedist dependency). | | dRofus | `dRofus.dRofus` | MSI, machine, x64 | Versioned ARP name ("dRofus 2.18") → fuzzy match. | | Devolutions Launcher | `Devolutions.Launcher` | MSI, machine, x64 | Distinct ARP identity from the existing Remote Desktop Manager FMA. | | Devolutions Workspace | `Devolutions.Workspace` | MSI, machine, x64 | Product renamed: ARP DisplayName is **"Devolutions Password Manager"** (set as `unique_identifier`). `program_publisher` overridden to "Devolutions Inc." (capital I) — verified via msiinfo; the locale-derived lowercase would not match. | | Delinea Connection Manager | `Delinea.DelineaConnectionManager` | MSI, machine, x64 | Dual-purpose MSI defaults to **per-user** (ALLUSERS=2 + MSIINSTALLPERUSER=1); custom install script forces `ALLUSERS=1 MSIINSTALLPERUSER=""`. `program_publisher` = "Delinea Inc.." (double period, as stored in the MSI). Unversioned URL → `ignore_hash`. | | DAX Studio | `DaxStudio.DaxStudio` | Inno, machine, x64 | `/ALLUSERS` for machine scope; versioned ARP name → fuzzy. | | DevPod | `LoftLabs.DevPod` | MSI, machine, x64 | Uses the WiX MSI variant (the manifest also has an NSIS per-user one). | | Directory Opus | `GPSoftware.DirectoryOpus` | Inno, machine, x64 | Standard Inno silent install/uninstall. | | DYMO ID | `DYMO.DYMOID` | InstallShield→MSI, machine, x86 | `/S /V"/qn /norestart"`; uninstall via msiexec by ProductCode. | | digiSeal Reader | `secrypt.digiSealreader` | EXE (self-extracting), machine, x86 | `installer_scope: ""` (manifest declares no scope); `-silent` install, shipped uninstaller with `-silent`. Unversioned URL → `ignore_hash`. | Considered but **not** added (recorded in the workstream tracker): - **Datadog Agent** (`Datadog.Agent`): winget PackageVersion is `7.81.0.1` but the MSI and registry report `7.81.0.0`, so the patch policy would flag every install as perpetually outdated. `use_display_version_for_patch` can't fix it (the manifest has no `AppsAndFeaturesEntries`); it needs a version-normalizing ingester ref (like `onepassword_version_shortener`). Deferred pending that helper (task spawned). - **Dell Display and Peripheral Manager** (`Dell.DisplayAndPeripheralManager`, covers both "Dell Display Manager" and "Dell Peripheral Manager"): the winget-pinned host `dl.dell.com` returns **403** to non-browser User-Agents, and Fleet's downloader sends `Go-http-client` (same failure that dropped Crestron AirMedia in letter C). The `downloads.dell.com` mirror serves the identical path to any UA, but there's no input field to override the manifest URL. Deferred pending a downloader User-Agent fix (task spawned — would also unblock Crestron). - **Dell EMC System Update** (`Dell.SystemUpdate`): registers its ARP entry under **HKCU** (per-user) under a SYSTEM install; legacy product Dell steers users away from (toward Dell Command Update, already an FMA); firmware/driver DUP bootstrapper. - **Devolutions Remote Desktop Manager Agent** (`Devolutions.RemoteDesktopManagerAgent`): legacy/superseded by "Devolutions Agent" (2026.1); winget manifest frozen at 2025.2.28.0 since Sept 2025; vendor docs page 404s. - **Dedoose** (`Dedoose.Dedoose`): per-user-only scope, x86, latest-pointer URL (CloudShow class). - **Defraggler** (`Piriform.Defraggler`): abandoned (final release 2020, no winget commits since 2023); legacy defrag tool with an unverified ARP publisher string. - **DiRoots ProSheets** (`DiRoots.ProSheets`): validated install but its Advanced Installer bootstrapper uninstall hung to the timeout and it drags bundled PDF24 Creator entries into inventory (dropped at validation). - **DroidCam Client** (`dev47apps.DroidCam`): NSIS `/S` install hung headless to the timeout (inline vc_redist); 3DxWare/Citrix headless-hang class (dropped at validation). Identities verified per app (msiinfo Property tables; installer PE/version resources; winget AppsAndFeaturesEntries; uninstall-database corroboration). Two publisher-casing mismatches (Devolutions Workspace, Delinea) were caught by direct MSI inspection and fixed with `program_publisher` before they could silently break the exists queries. SHAs verified against manifests for pinned URLs; `ignore_hash` used only where the manifest is demonstrably actively maintained. Icons via `tools/software/icons/generate-icons.sh` (the pre-existing DataSpell icon component is reused untouched). # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [ ] QA'd all new/changed functionality manually (relying on the FMA CI validator for Windows install/uninstall validation) |
||
|
Magnus Jensen
|
240ae88408 |
inconsistent font size tooltip (#49121)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48229 <img width="465" height="151" alt="image" src="https://github.com/user-attachments/assets/af282c1a-af0d-4184-831d-cb7a98fc6bc8" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where the “Require BitLocker PIN” tooltip could render with an inconsistent font size. * Kept the Windows instructions content the same while adjusting the tooltip layout/line breaks for consistent display. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
f5531fdf1b |
Tooltips not always showing for full name (IdP) (#49116)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48125 Side effect is that we will no longer show the "Connect IdP" tooltip. https://github.com/user-attachments/assets/303836fb-a1c3-4d5e-9c2b-3fddd0dfb4d1 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Resolved an issue in the device Details → Users area where tooltips for a person’s full name and related IdP fields could fail to appear. * Tooltips now render reliably and show the correct help text when hovering the affected fields. * **Tests** * Expanded automated coverage to confirm tooltip visibility and the displayed tooltip content for the user details card. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
05867fe955 |
Stop premium calls on Fleet free (#49118)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47943 It no longer calls `ab_tokens` and `vpp_tokens` on fleet free <img width="1317" height="561" alt="image" src="https://github.com/user-attachments/assets/6556f91e-a7e4-487c-9961-3a22104329d3" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where Fleet Free accounts could trigger premium MDM calls. * Restricted premium token retrieval to eligible premium-tier accounts. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
9a24cb1d5d | Fix long certificate name overflow in delete certificate modal (#48948) (#49019) | ||
|
Andrew Mellor
|
4922289610 |
48917 Show a deleted state instead of a generic error for stale MDM command (#49012)
**Related issue:** Resolves #48917 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Bug Fixes** * The MDM command details modal now shows **“This command has been deleted.”** instead of a generic error when a command result is removed after the host is wiped and re-enrolled. * The modal now uses additional stored activity context (like host display name and request type) to render more accurate, host-specific details for deleted commands. * **Tests** * Updated and added coverage to confirm the deleted-message UI and that the generic error text no longer appears. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
73b4bc8e6a |
Policy status automation activities bug fixes
Relates to #38670 Several fixes to the policy details page's "Automation runs" feed and the labels modal: - Empty state: when activity expiry is enabled, show the configured retention window ("Automation history is retained for N days"); otherwise show a generic "Automation history will appear here". - Details column focus: replace the deprecated `text-icon` button variant with `inverse`, and inset the keyboard-focus outline so it no longer hugs the cell text or bleed into adjacent rows. - Labels modal: render policy labels as react-router links (real anchors) instead of buttons, so they can be opened in a new tab via middle-click or cmd/ctrl-click. - Status filtering: make the installed_software and VPP (installed_app_store_app) error/success conditions null-safe complements of the displayed status, so every row shown under "All" appears under exactly one of the status filters. Derive the VPP outcome from the historical details.status (activities are terminal-only) rather than the live verification columns, which mutate over the install's lifetime. - Install output: surface the pre-install query output and post-install script output as separate sections in the activity details modal, and fall back to them in the grid preview when the install-script output is empty (e.g. a pre-install-stage failure). - Add a datastore test asserting the status filters partition the feed (all = error ⊎ success) for every activity type. |
||
|
|
6d2167193e |
Apple MDM: require server URL confirmation before turning off (#48595)
Adds a text input to the "Turn off MDM" confirmation modal that requires the admin to type the Fleet server URL before the Turn off button becomes enabled. Prevents accidental MDM deactivation on the wrong Fleet instance. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42073 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved the Apple MDM disable flow by requiring the correct Fleet URL before confirming the action. * The disable confirmation modal now appears only when the needed configuration is available, reducing the chance of errors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai> |
||
|
Magnus Jensen
|
bfc986df7e |
update missed ABM references (#49027)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48314 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated Apple Business Manager references across admin and host device flows to use the shorter “AB” wording. * Improved user-facing copy in enrollment, status, tooltip, and error messages for consistency. * Adjusted the automatic enrollment button label to match the updated terminology. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
89e653ce2b |
Update Windows MDM end user experience language (#47635)
**Related issue:** Resolves #43379 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated Windows MDM enrollment option labels from “Automatic/Manual” to “Fleet agent-driven/End user-driven” and refreshed the related on-page description/help text. * Adjusted radio help-text spacing and added styling for label formatting on the Windows MDM settings page. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
cacd7308af |
Add missing FMA icons for software catalog (#48995)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA ## Summary Several Fleet-maintained apps were showing the generic fallback icon on the [fleetdm.com software catalog](https://fleetdm.com/software-catalog). The website resolves icons by slug (`app-icon-<slug>-60x60@2x.png`) with no reuse map, so each app needs its own PNG file — and these were missing. - **Amazon Corretto 11 / 17 / 8 / JRE 8** — added website PNGs reusing the shared Java "Duke" logo. (Already reuse `AmazonCorretto21` via the frontend icon map, so no frontend change.) - **AWS Session Manager Plugin** — added website PNG reusing the AWS CLI icon. (Already reuses `AwsCli` via the frontend map.) - **Amazon Redshift ODBC Driver** — had no icon on either surface. Added a new frontend icon component + map entry (official AWS Redshift icon) and the website PNG. Icons generated via `tools/software/icons/generate-icons.sh`. The duplicate-PNG-per-slug approach matches the existing catalog convention (e.g. `postgresql-15/16/17/18`, `python-3.13/3.14`, `azul-zulu-25-jdk/jre`). # Checklist for submitter - [ ] QA'd all new/changed functionality manually |
||
|
RachelElysia
|
7cb7a162b0 | Fleet UI: Policy details page labels/automations use TruncatedTextList (#48977) | ||
|
Allen Houchins
|
f24af180c0 |
Add Windows FMAs (letter C): 13 apps (#48969)
**Related issue:** N/A — part of the Windows Fleet-maintained apps catalog expansion (letter C batch; follows #48872, #48881, #48950). Adds seventeen new Windows Fleet-maintained apps: | App | winget package | Installer | Notes | |-----|----------------|-----------|-------| | Advanced Installer | `Caphyon.AdvancedInstaller` | MSI, machine, x64 | Versioned ARP name ("Advanced Installer 23.8") → fuzzy match. | | Certify The Web | `CertifyTheWeb.CertifySSLManager` | Inno, machine, x64 | ARP name is "Certify Certificate Manager version 7.1.0.0" (product renamed at v7) → fuzzy on "Certify Certificate Manager". | | Chatbox | `Bin-Huang.Chatbox` | NSIS (electron-builder), machine, x64 | `/allusers /S`; custom exists query excludes the separate Chatbox Community Edition; uninstall matches `Chatbox [0-9]*`. | | Citrix Workspace | `Citrix.Workspace` | Vendor bootstrapper EXE, machine, x86 universal | ARP name "Citrix Workspace \<YYMM\>" → fuzzy. Uninstall runs the registered TrolleyExpress with `/uninstall /cleanup /silent`; 3010 treated as success. See "not added" for the LTSR caveat. | | CPU-Z | `CPUID.CPU-Z` | Inno, machine | `installer_locale` pinned to en-US (manifest also carries zh-CN); `/ALLUSERS` added to Inno switches; versioned ARP name → fuzzy. | | CodeMeter Runtime Kit | `Wibu-Systems.CodeMeterRuntimeKit` | Vendor bootstrapper embedding MSI, x64 | `installer_scope: ""` (manifest declares no scope; embedded MSI is per-machine). Install `/q /nosplash /ComponentArgs "*":"/quiet /norestart"`; uninstall via msiexec by ARP name prefix. Identity verified by carving the embedded MSI. | | ClipboardFusion | `BinaryFortress.ClipboardFusion` | Inno, machine, x64 | ARP name carries a locale-dependent "(64-bit)" suffix → fuzzy pattern `ClipboardFusion%`; `/LAUNCHAFTER=0` prevents post-install launch. | | CloudShow | `BinaryFortress.CloudShow` | Inno, machine, x64 | Same Binary Fortress framework; ARP name "CloudShow Launcher (64-bit)" is framework-inferred (no third-party corroboration exists) — the CI validator is the confirmation. | | ClockAssist | `ClockAssist.ClockAssist` | MSI, machine, x64 | Latest-pointer URL but actively maintained manifest (bot replaces the single version dir ~6-weekly) → `ignore_hash`. | | Crestron AirMedia | `Crestron.AirMedia` | MSI, machine, x86 | ARP name is "Crestron AirMedia Machine-Wide Installer" (Teams-style per-user stamping); identity from msiinfo. | | Crestron AirMedia Peripherals | `Crestron.AirMediaPeripherals` | MSI, machine, x64 | Clean MSI. LaunchCondition fails install (1603) on hosts with a pending reboot — noted. | | CrisisGo | `CrisisGo.CrisisGo` | InstallShield Basic MSI, machine, x86 | Custom install script passes `ISSETUPDRIVEN=1` to defuse the "must run setup.exe" guard (vendor ships this bare MSI for network deployment; winget sandbox validates it). | | Cyberduck CLI | `Iterate.CyberduckCLI` | MSI, machine, x64 | Clean WiX MSI. winget lags the vendor by ~4 releases, but pinned URLs stay live, so installs work — just not bleeding-edge. | | Cisco Webex Recorder and Player | `Cisco.WebexRecorderAndPlayer` | InstallShield MSI, machine, x86 | Legacy WRF player but actively updated by Cisco (8 winget bumps in 10 months); latest-pointer URL → `ignore_hash`. | | Creative Force Kelvin | `CreativeForce.Kelvin` | WiX MSI, machine, x64 | Manifest offers per-user NSIS, machine NSIS, and MSI — the MSI is selected (unversioned ARP name "Kelvin"). | | Creative Force Triad | `CreativeForce.Triad` | NSIS (electron-builder), machine, x64 | `/allusers /S`; versioned ARP name → fuzzy. | | Cube Browser | `RystadEnergy.CubeBrowser` | WiX burn bundle, machine, x64 | Bundle Arp manifest carved from the installer ("Cube Browser (64 bit)"); dual-mode uninstall (prefers bundle entry, msiexec fallback) since bundle + chained MSI may both register the same name. | Considered but **not** added (recorded in the workstream tracker): - **Citrix Workspace app LTSR** (`Citrix.Workspace.LTSR`): the LTSR and current tracks register the **identical** ARP key (`CitrixOnlinePluginPackWeb`) and the same "Citrix Workspace \<YYMM\>" DisplayName with no LTSR marker — the only discriminator is a registry value outside the programs table, so Fleet inventory cannot tell the tracks apart. An LTSR FMA would cross-match current-release installs (and vice versa). **Consequence for the shipped Citrix Workspace FMA:** hosts running LTSR will match it and may show "update available" toward the current release — flagged here for reviewer judgment. - **Charles** (`XK72.Charles`): all winget 5.x manifests are per-user MSIX only. The vendor ships a machine-scope MSI for 5.2 but it isn't indexed in winget; revisit if the manifest adds it. - **Calibrite Profiler** (`Calibrite.PROFILER`): abandoned winget manifest — one version dir ever while the vendor is five releases and a major version ahead. - **Cloud Drive Mapper** (`IAMCloud.CloudDriveMapperV3`): latest-pointer URL whose manifest SHA is already stale, and the MSI sets `ARPSYSTEMCOMPONENT=1`, hiding the ARP entry from inventory entirely. - **CloudCompare** (`CloudCompare.CloudCompare`): registry DisplayVersion (and the winget PackageVersion itself) embed a parenthetical date — "2.13.2 (07-06-2024)" — which breaks version comparison; manifest also stale. - **Classic Shell** (`IvoSoft.ClassicShell`): development ended in 2017; superseded by Open-Shell. (CutePDF Writer was already deferred in the letter A batch.) Identities verified per app (msiinfo Property tables; burn bundle Arp manifests carved from installers; AppxManifest/electron-builder sources; uninstall-database corroboration). SHAs verified against manifests for pinned URLs; `ignore_hash` used only where the manifest is demonstrably actively maintained. Icons via `tools/software/icons/generate-icons.sh`; the pre-existing CitrixWorkspace icon component is reused untouched. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [ ] QA'd all new/changed functionality manually (relying on the FMA CI validator for Windows install/uninstall validation) |
||
|
Nico
|
4c6aa754e0 |
Time ago timestamps: use days instead of months when under 90 days (#48964)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46965 Relative "time ago" timestamps switched to months at ~30 days, so a timestamp 45 days ago read "about 2 months ago" (even 89 days showed "3 months ago"). This centralizes the day/month cutoff in a new `timeAgo` helper and routes existing call sites through it, so anything under 90 days is shown in days. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Relative “time ago” timestamps now keep values in **days** for items under **90 days**, switching to **months** later for more accurate wording. * Improved consistency of relative time labels across status modals, activity feeds, host details, and management screens (including “last updated,” “uploaded,” and “added” text). * **Tests** * Added/updated coverage for the shared relative-time cutoff and formatting behavior to prevent regressions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
c759f92f14 |
Include mobile hosts by default in "Hosts online" chart (#48769)
**Related issue:** Resolves #47661 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features / Improvements** * The “Hosts online” chart now includes mobile platforms (iOS/iPadOS/Android) by default, alongside desktop platforms. * **Bug Fixes** * Initial load no longer shows a default “Filtered” badge; the chart reflects the full default platform selection. * **Documentation** * Updated the “Hosts online” tooltip to clarify how locked iOS/iPadOS, lid-closed Mac, and locked Android states affect the online count. * **Tests** * Updated chart card tests to match the new default platform behavior and initial chart request parameters. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
360789913a |
Add icon for Okta Advanced Server Access macOS FMA (#48956)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> The Okta Advanced Server Access macOS Fleet-maintained app had no icon — the Fleet UI fell back to the generic package icon, and the fleetdm.com software catalog used the fallback icon. The icon was extracted from the vendor's `ScaleFT.app` bundle inside `ScaleFT-1.108.0.pkg` (downloaded from the URL in `ee/maintained-apps/outputs/okta-advanced-server-access/darwin.json`; SHA-256 verified against the manifest) and generated with `tools/software/icons/generate-icons.sh`: - `frontend/pages/SoftwarePage/components/icons/ScaleFt.tsx`: new icon component. - `frontend/pages/SoftwarePage/components/icons/index.ts`: two map entries — `"okta advanced server access"` (matches the FMA list name) and `"scaleft"` (matches host inventory, since the app's `CFBundleName` is `ScaleFT` and there is no `CFBundleDisplayName`). - `website/assets/images/app-icon-okta-advanced-server-access-60x60@2x.png`: 128×128 PNG for the fleetdm.com software catalog (filename follows the `app-icon-<slug>` convention used by `build-static-content.js`). # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a new software icon for ScaleFT/Okta Advanced Server Access. * The icon now appears automatically when those software names are recognized in the app. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rahul Raghunathan
|
c92b848919 |
Return to previous page when the last policy on a page is deleted (#48683)
**Related issue:** Resolves #48641 ## Description Deleting the only policy on a paginated page (e.g., 21 policies, with 1 on page 2) left the user stranded on a now-empty page showing the "No policies" empty state. The policies list now steps back to the previous page when a delete empties the current page. **Before:** delete last policy on page 2 → empty state. **After:** delete last policy on page 2 → list returns to page 1. ### Screen recording demonstrating the fix https://github.com/user-attachments/assets/ae106a50-7f9b-4080-a19c-53e0c60fff48 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Server-side paginated tables now recover from empty states after deleting the last row on a page by redirecting to the last page that still has data. * Improved empty-state pagination handling for out-of-range pages, loading states, and cases where the total row count is known (including zero), avoiding unnecessary or repeated navigation. * Simplified the empty-state pagination UI to render only the empty component. * **Tests** * Expanded regression test coverage for server-side pagination edge cases and page-correction behavior to prevent future regressions. * **Style** * Removed unused empty/previous-button styling rules in the table container. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
496d4f5e24 | Controls > OS settings > Certificates: View certificates (#48460) | ||
|
Allen Houchins
|
2708df6f40 |
Add Windows FMAs (letter B): 5 apps (#48950)
**Related issue:** N/A — part of the Windows Fleet-maintained apps catalog expansion (letter B batch; follows #48872 and #48881). Adds six new Windows Fleet-maintained apps: | App | winget package | Installer | Notes | |-----|----------------|-----------|-------| | BandiView | `Bandisoft.BandiView` | EXE (NSIS-style), machine, x64 | Unversioned InstallerUrl → `ignore_hash` (URL verified to serve the binary reliably without Referer tricks). DisplayName "BandiView" stable across releases. | | BleachBit | `BleachBit.BleachBit` | EXE (NsisMultiUser), machine, x86 | Install script passes the case-sensitive `/allusers /S` — without `/allusers` the NsisMultiUser installer's scope is ambiguous. winget declares a VCRedist 2010 x86 dependency Fleet can't satisfy; noted as a caveat. | | Bulk Crap Uninstaller | `Klocman.BulkCrapUninstaller` | EXE (Inno), machine, x86 | ARP DisplayName is versioned ("BCUninstaller 6.2.0.0") and never matches the friendly name, so `unique_identifier` "BCUninstaller" + `fuzzy_match_name`. Registry version is 4-part vs winget's "6.2" — `version_compare` pads, verified consistent. | | BrowserStackLocal | `BrowserStack.BrowserStackLocal` | MSI (WiX), machine, x64 | Clean MSI (ALLUSERS=1, identity verified via msiinfo). Unversioned InstallerUrl → `ignore_hash`. | | Burp Suite Professional | `PortSwigger.BurpSuite.Professional` | EXE (install4j), machine, x64 | Mirrors the existing Burp Suite Community FMA: `-q -Dinstall4j.suppressUnattendedReboot=true` plus the load-bearing `-dir` into Program Files (install4j defaults to per-user otherwise). DisplayName is versioned **without** "Edition" ("Burp Suite Professional 2026.3.3"), unlike Community — fuzzy pattern `Burp Suite Professional %` can't collide with Community's. | | Bytello Share | `Bytello.BytelloShare` | EXE (NSIS), machine, x86 | Uses the nullsoft `agent=d` variant whose ARP identity ("Bytello Share" / publisher "Bytello Share") matches real-world inventory; the zip variant registers a different name ("BytelloShare") and its nested-MSI path is version-pinned and already stale. Vendor URL is a latest-pointer already ahead of winget → `ignore_hash`. **Note:** the input says `installer_type: "msi"` — the ingester classifies this nullsoft entry as msi because its URL has no file extension (vendor-type → URL-extension → machine-scope fallback chain in `ingester.go`); the custom scripts handle the actual NSIS exe. | Considered but **not** added (recorded in the workstream tracker): - **Bambu Studio** (`Bambulab.Bambustudio`): the uninstaller shows a keep-user-data confirmation dialog even with `/S` (deployment guides work around it with Send-Keys, impossible in a SYSTEM session) — same failure class that disqualified Adobe AIR in the letter A batch. - **Bridge Designer** (`StephenRessler.BridgeDesigner`): installer URL 404s (file removed from SourceForge) and the desktop product was discontinued July 1, 2026 in favor of a browser-based edition. - **BurnAware Free** (`Burnaware.BurnAwareFree`): the vendor deletes each old release URL — the winget-pinned installer already redirects to their homepage, so pinned downloads break every release cycle. Registry identities were verified per app (msiinfo Property tables for MSIs; vendor installer sources, winget AppsAndFeaturesEntries, and uninstall-database corroboration for EXEs). Installer SHAs verified against manifests where URLs are version-pinned; unversioned URLs use `ignore_hash` per the TeamViewer/Chrome precedent. Icons generated via `tools/software/icons/generate-icons.sh`. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [ ] QA'd all new/changed functionality manually (relying on the FMA CI validator for Windows install/uninstall validation) |
||
|
Lucas Manuel Rodriguez
|
646ebd09e3 |
Remove Zorin from platform for labels (#48937)
Fixing `Zorin OS` incorrectly showing up as platform option for labels. Coming soon we'll have a "Linux" platform for labels (https://github.com/fleetdm/fleet/issues/44088). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Removed **Zorin OS** from the platform dropdown, so it is no longer available as a selectable option. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
e37017ce0c |
Replace duplicate code with existing getDisplayedSoftwareName helper (#48311)
Follow-up to https://github.com/fleetdm/fleet/pull/46839#discussion_r3475389665. Related to #46921. # Checklist for submitter ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved how software names are shown in install status views, so the displayed name now better matches the preferred label. * Added support for host online status when determining install status display and tooltip text, improving the accuracy of status messaging. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
4351f4cee5 |
escrow snapd TPM-backed FDE recovery keys from orbit (#48452)
**Related issue:** Resolves #44428 |
||
|
RachelElysia
|
0b9ca60e73 | Fleet UI: Restore download button for script-only packages (#48909) | ||
|
RachelElysia
|
c21d5fad09 | Fleet UI: 'Latest' pin only shows on Fleet-maintained apps (#48871) | ||
|
Allen Houchins
|
0b929a1ff1 |
Add Windows FMAs (letter A): 14 apps (#48881)
This pull request adds support for several new Windows applications to the maintained apps catalog, primarily by introducing new JSON manifest files for each app and, in some cases, associated PowerShell install/uninstall scripts. These additions expand the catalog's coverage of productivity, developer, utility, and communication tools, and include detailed installation and uninstallation logic for certain apps. **New application manifests:** * Added JSON manifests for a variety of applications, including but not limited to: Adobe AIR, Agent Ransack, AIMP, Air Explorer, alfaview, Allway Sync, Amazon Corretto (versions 8, 11, 17), Amazon Redshift ODBC Driver, AnyBurn, AnyDesk, AVS Image Converter, AVS Media Player, AWS Session Manager Plugin, Azure Functions Core Tools, CutePDF Writer, and iTunes. Each manifest specifies installation parameters, categories, and (where applicable) custom install/uninstall scripts. [[1]](diffhunk://#diff-891e1b685eea289f7535f5cb3e80299b2d53d22f1ecb4123a6db873b4715d5d3R1-R13) [[2]](diffhunk://#diff-33d1963698285631553094360f1dab939589c853b20b13046aeed9c36b484120R1-R12) [[3]](diffhunk://#diff-48b51963ae1bc8ce2e6d2aa494c7db8df854a0a6f392df70528dc80efb0d4341R1-R12) [[4]](diffhunk://#diff-8177fe092e9e1cc91dd1582d1e4c01b05176d36dbad36ca16397a681aef7c4a5R1-R13) [[5]](diffhunk://#diff-c1fd695df858d34d29653fb1db79c04123bbfcf432726f9356d893c7bc4e4b16R1-R11) [[6]](diffhunk://#diff-4024c71281805493b749ec7aa95819583015483d652481954a3dd4d2ba3803e4R1-R10) [[7]](diffhunk://#diff-8ab1198cecc28b2b9b77a8668355fd505524a59d414eb7623e9676794c03511eR1-R11) [[8]](diffhunk://#diff-d8534d1ac84c02c1f87dae2798feae0d03fdb332d19a03fd780c9664c337ce41R1-R11) [[9]](diffhunk://#diff-375f7eb8d9daf96d4952a5f834a4ba5fa272c034ff808b3f21dbd33cf57b7b7eR1-R10) [[10]](diffhunk://#diff-0710c7d70ff8eb04379932f0ffd0b754626381372ef6a747858eb7b51c230723R1-R10) [[11]](diffhunk://#diff-ce4007e90efa1fdfff5c1ca96c8dded2108642a522f30baddcefd9327c23c980R1-R13) [[12]](diffhunk://#diff-9a7ba8c0afb32ab31c2950a4a95847fa1293411416302cd6698dc2bcb519fbfdR1-R13) [[13]](diffhunk://#diff-02ae7cdbe54f1736023e830b66036c6f32e5eec642d888f51c6dcfbbb0bf12d0R1-R14) [[14]](diffhunk://#diff-4d3d9fbb9e19bdf5269ff241fc1549a17b9045a04b0358c988fb81ceb03512e1R1-R14) [[15]](diffhunk://#diff-c22a0370648cd85f36926d2412d10cb46d3f3da4a623ad4595c115496ac6cd41R1-R13) [[16]](diffhunk://#diff-5dfe747ae19dfa1572611d72dc109a8cbfe8b379410c4154627e9d1c699670d1R1-R12) [[17]](diffhunk://#diff-4afa6cde8c52e27d865f759ab7f2aabf5f60522cb8bfe120637a4a954194a237R1-R13) [[18]](diffhunk://#diff-d5ad3e810b587a379fdb2722806be5a0c47eebefad540077db86d356cfd30e17R1-R12) **Custom installation and uninstallation scripts:** * Added PowerShell scripts for silent installation and uninstallation of Adobe AIR, including logic to extract and execute the correct uninstall command from the Windows registry, ensuring a clean and unattended removal process. [[1]](diffhunk://#diff-75bb214bff0533824521c36d0f6ff369ac7848554824f5f44faadc7c7c3225ffR1-R30) [[2]](diffhunk://#diff-e10832f9465648bd3c3055d3ab2bde1d4cb3170db6ede0de0b0dc347ab3077f3R1-R58) These changes improve the breadth and automation capabilities of the maintained apps catalog, especially for environments that require silent and reliable software deployment and removal.…esk, iTunes, Azure Functions Core Tools <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Allen Houchins
|
ceeaf9eea2 |
Add Windows FMAs (digit batch): 3DF Zephyr Free, 4K Video Downloader+ (#48872)
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion.
Adds two new Windows Fleet-maintained apps (the "digit" batch of the
Windows FMA workstream):
| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| 4K Video Downloader+ | `OpenMedia.4KVideoDownloaderPlus` | EXE (WiX
burn bundle), machine scope, x64 | Bundle registration extracted from
the installer: ARP `DisplayName` "4K Video Downloader+", `Publisher`
"InterPromo GMBH" (differs from the winget locale publisher "Open Media
LLC", so `program_publisher` is set). Registers TWO ARP entries with the
same DisplayName (the bundle and its chained MSI). The uninstall script
prefers the bundle entry and normalizes msiexec args when only the MSI
entry is present (validator-confirmed). Exact DisplayName matching keeps
it from touching the non-plus product. |
| 3DF Zephyr Free | `3Dflow.3DFZephyr.Free` | EXE (Inno Setup), machine
scope, x64 | Registry DisplayName is versioned ("3DF Zephyr Free version
8.038"), so the input uses `fuzzy_match_name: true`. The paid edition
registers as "3DF Zephyr version X" (no "Free") and is not matched.
Standard Inno silent switches. |
Also considered from this batch but **not** added:
- **4K Video Downloader** (`OpenMedia.4KVideoDownloader`, the classic
4.x app): verified and validated successfully, but intentionally dropped
— it's in maintenance mode and 4K Video Downloader+ is the actively
developed successor, so we're offering only the + app.
- **3DxWare 10** (`3Dconnexion.3DxWare.10`): the vendor bootstrapper
hung for 10 minutes and exited 1 with no output in the validator's
headless SYSTEM session (driver install), so it was dropped after the
first validation run.
- **3CX Desktop App** (`3CX.Softphone`): MSIX with an unversioned
`InstallerUrl` (`.../3CX.msix`) — the file at that URL is already a
newer build (20.0.1162.0) than the manifest's pinned version/SHA
(20.0.1102.0), so installs would fail hash validation. Can be revisited
with `ignore_hash` plus Windows-App-style MSIX provisioning scripts.
Installer SHAs in the outputs were verified against the winget
manifests. Icons generated via `tools/software/icons/generate-icons.sh`;
icon component names were adjusted to valid JS identifiers
(`ThreeDfZephyrFree`, `FourKVideoDownloaderPlus`) following the
`ZeroOneZeroEditor`/`FourK*` precedent.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
|
||
|
Juan Fernandez
|
156302adb4 |
Fix policy automation activities missing from host activity feed
Closes #48616 Adds missing policy automation activities to host's details page. |
